protocol-reverse-engineering

Analyze network traffic and document proprietary protocol structures using Wireshark, Scapy, and tshark.

Updated Apr 23, 2026

Search Tags:#network security #reverse engineering #protocol analysis #packet capture #fuzzing #wireshark #scapy

Ready to run

npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill protocol-reverse-engineering-sanketadlak

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: protocol-reverse-engineering
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/protocol-reverse-engineering
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill protocol-reverse-engineering-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Understanding undocumented or proprietary network protocols requires tedious manual packet inspection, and this Skill provides structured techniques for capturing, dissecting, and documenting binary and text-based protocols. ## Core Features & Use Cases - Traffic Capture: Capture packets with Wireshark, tshark, tcpdump, and mitmproxy including TLS interception and ring buffer rotation. - Protocol Analysis: Identify protocol signatures, parse binary structures with Python and Scapy, and detect encryption via entropy analysis. - Documentation & Testing: Write protocol specifications, build Lua dissectors for Wireshark, and fuzz implementations with Boofuzz. - Use Case: When integrating with a third-party device that uses an undocumented TCP protocol, capture its traffic, reverse the message format, and write a Lua dissector so your team can debug communication in Wireshark. ## Quick Start Analyze the attached capture.pcap file and help me identify the protocol structure and message format used on port 8888.

Frequently Asked Questions about protocol-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reverse engineer a proprietary network protocol?▼

Capture multiple traffic sessions with tcpdump or Wireshark, identify message boundaries and magic bytes, then compare samples to map header fields like length, type, and sequence numbers. Validate your understanding by writing a Python parser with struct and documenting the format.

How to capture network traffic with tcpdump and Wireshark?▼

Use tcpdump -i eth0 -s 0 -w capture.pcap to record full packets to a file, or tshark for ring-buffer rotation. Open the pcap in Wireshark to apply display filters, follow TCP streams, and export objects for deeper analysis.

How can I tell if protocol traffic is encrypted?▼

Calculate byte entropy of the payload: values above 7.5 bits per byte suggest encryption or randomness, while below 6.0 indicates plaintext or structured data. Also check for TLS record headers (0x16 0x03) and block-aligned lengths typical of AES.

Can Wireshark decrypt TLS traffic from a capture?▼

Yes, if you have the session keys. Set the SSLKEYLOGFILE environment variable in the browser to log pre-master secrets, then point Wireshark's TLS preferences to that file. RSA private key decryption only works for non-ephemeral key exchanges.

How do I write a custom Wireshark dissector in Lua?▼

Define a Proto object with ProtoFields for each header field, implement a dissector function that reads offsets from the buffer, and register it via DissectorTable for a specific TCP port. Wireshark then decodes matching packets automatically.

What are the limitations of replaying captured packets with Scapy?▼

Replayed packets fail when protocols use sequence numbers, timestamps, nonces, or session tokens that must be fresh. You must modify these fields and recalculate IP and TCP checksums before sending, or the target will reject the traffic.